EP1850256B1 - Prüfung der Berechtigung der Installation einer Softwareversion - Google Patents

Prüfung der Berechtigung der Installation einer Softwareversion Download PDF

Info

Publication number
EP1850256B1
EP1850256B1 EP06388031A EP06388031A EP1850256B1 EP 1850256 B1 EP1850256 B1 EP 1850256B1 EP 06388031 A EP06388031 A EP 06388031A EP 06388031 A EP06388031 A EP 06388031A EP 1850256 B1 EP1850256 B1 EP 1850256B1
Authority
EP
European Patent Office
Prior art keywords
message authentication
authentication code
value
counter
integrity protection
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Not-in-force
Application number
EP06388031A
Other languages
English (en)
French (fr)
Other versions
EP1850256A1 (de
Inventor
Bernard Smeets
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Telefonaktiebolaget LM Ericsson AB
Original Assignee
Telefonaktiebolaget LM Ericsson AB
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to AT06388031T priority Critical patent/ATE470909T1/de
Application filed by Telefonaktiebolaget LM Ericsson AB filed Critical Telefonaktiebolaget LM Ericsson AB
Priority to EP06388031A priority patent/EP1850256B1/de
Priority to DE602006014801T priority patent/DE602006014801D1/de
Priority to US12/298,220 priority patent/US8880898B2/en
Priority to CN200780014710.8A priority patent/CN101427259B/zh
Priority to PCT/EP2007/003389 priority patent/WO2007121903A1/en
Priority to JP2009506952A priority patent/JP5038397B2/ja
Priority to KR1020087028597A priority patent/KR20090005390A/ko
Priority to CA002646003A priority patent/CA2646003A1/en
Priority to TW096114272A priority patent/TW200817964A/zh
Publication of EP1850256A1 publication Critical patent/EP1850256A1/de
Application granted granted Critical
Publication of EP1850256B1 publication Critical patent/EP1850256B1/de
Not-in-force legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2105—Dual mode as a secondary aspect

Definitions

  • Embedded systems like mobile phones and other data processing devices depend on the execution of correct software. Furthermore, software even for rather small systems becomes increasingly complex, thereby increasing the risk of errors and unintended features, especially in early releases during a software life cycle. Furthermore, the functionality of early software releases is typically limited. Consequently, there is an increasing need for frequent updates of the software stored in embedded devices from older versions to updated versions. In order to keep track of which version is installed in the device, the device typically maintains a version counter whose value corresponds to the currently installed version number.
  • a method of maintaining a version counter by a processing device comprising selectively operating the processing device in one of a first and second mode, wherein access to operating the processing device in the first mode is limited to authorised users and controlled separately from access to the second mode.
  • the step of operating the processing device in the first mode includes
  • the processing device is selectively operatable in one of a first and second mode, wherein access to operating the processing device in the first mode is limited to authorised users and controlled separately from access to the second mode.
  • a user who is authorised to operate the device in the second mode is not necessarily also authorised to operate the device in the first mode.
  • the selective operation may for example be implemented by providing two modes in which the device can be booted, or by initially granting access in the second mode and, conditioned on a successful access control, provide access to additional functionality provided in the first mode.
  • the removal of the integrity protection value may be performed in a number of different ways, e.g. by overwriting a revoked integrity protection value by an updated value, by overwriting the protection value by predetermined data items, e.g. zeros, or in any other suitable way that prevents a user from subsequently retrieving the removed data from the storage medium.
  • the above update policy may, on the face of it, seem to be less strict than a policy that strictly prevents every version roll-back including a roll-back back to the initial version with which the device was acquired, once the device was updated in the meantime to a subsequent version.
  • a strict enforcement of such an update policy would require a mechanism for forcing a user to update the software whenever an update to a newer version is available. Without such a mechanism, the user may just omit updating the device and thereby still being able to operate the device with the initial software version without having to perform a version roll-back.
  • version counter is intended to refer to any device or mechanism that provides a substantially unique value for each of a sequence of versions of memory content, e.g. software versions, versions of stored data, or the like.
  • the version counter may be implemented as a sequentially ordered set of data items, e.g. numbers or other values. It is understood that the version counter may also be implemented as a random number generator that generates a non-repetitive sequence of random numbers or as another unique value generator.
  • the version counter is a version counter for counting a software version of software installed in the device.
  • operating the processing device in the first mode includes
  • a set of integrity protection values is created and stored during an initial operation of the device in the first mode.
  • the version counter is to be incremented from a current value to a subsequent value during subsequent operation of the device in the second mode, the integrity protection value or values corresponding to counter values preceeding the subsequent value - and in particular the integrity protection value corresponding to the current counter value - are removed from the storage medium, thereby preventing subsequent cryptographic verification of the current counter value.
  • two modes of incrementing the counter may be provided: an irreversible incrementing wherein the previous integrity protection values are removed, and a reversible incrementing, where the integrity protection values are not removed.
  • the removal of the integrity protection value may be performed after a predetermined time has been elapsed from the actual incrementing of the counter.
  • the removal of the integrity protection value may be performed after a predetermined number of reboots after the actual incrementing of the counter. Such a delayed commitment of the counter update may be useful in order to allow a user to test the proper operation of an updated software version before committing to it.
  • the method further comprises providing an integrity protection value calculation unit adapted to output a generated integrity protection value of said sequence of integrity protection values only when the device is operated in the first one of said first and second modes. Consequently, only a user authorised to operate the device in the first mode can (re)calculate the integrity protection values. For example, a device manufacturer may chose to limit access to the first mode to said manufacturer. Consequently, the manufacturer may, during production of the electronic device, operate the device in the first mode as to generate and store a suitable number of integrity protection values on the device. All subsequent users who acquire the device may only access the device in the second mode and are thus prevented from re-generating integrity protection values for outdated counter values.
  • incrementing a current counter value to a subsequent counter value includes generating a subsequent integrity protection value corresponding to the subsequent counter value; and replacing the current integrity protection value with the subsequent integrity protection value. Consequently, in this embodiment, there is no need to store a large number of integrity protection values in the device from the outset, thereby saving storage capacity and avoiding limiting the range of protectable counter values by the number of stored integrity protection values. Furthermore, when operated in the second mode, the device only generates integrity protection values corresponding to subsequent counter values, thereby still preventing a user not authorised to operate the device in the first mode from re-generating integrity protection values of previous counter values, i.e. lower ranking counter values than the current counter value with respect to the sequential ordering of counter values.
  • the security of the method is further increased, since the device only generates a subsequent integrity protection value when the current value is successfully verified.
  • each generated integrity protection value is unique for the corresponding counter value and the device, a user is prevented from merely copying previous integrity protection values from another device in which the counter has not yet been incremented.
  • integrity protection value is intended to comprise any data item generated by a mechanism for assuring that information stored in the memory is not accidentally or maliciously altered or destroyed.
  • Examples of integrity protection mechanisms include message authentication codes, one-way hash functions, and digital signatures.
  • the integrity mechanism is a cryptographic integrity protection mechanism based on a secret key, the security of the integrity protection is increased.
  • the integrity protection value is a message authentication code, a particularly secure and efficient integrity protection is achieved.
  • MAC Message authentication codes
  • a MAC is a function that takes a variable length input and a key to produce a fixed-length integrity protection value as an output, the so-called MAC value or tag value.
  • MACs are typically used between two parties that share a secret key in order to validate information transmitted between these parties.
  • a MAC may be calculated by applying a one-way hash function to the data and encrypting the result using a secret key. Examples of suitable MAC functions that can be combined with a cryptographic hash function include HMAC (Keyed-Hashing for Message Authentication), Cipher Block Chaining (CBC) MAC using for example AES or a secure one-way hash function.
  • HMAC Keyed-Hashing for Message Authentication
  • CBC Cipher Block Chaining
  • a message authentication code is used to check the integrity of the counter value stored in a storage medium of the processing device, thereby avoiding the need for storing the counter value in a secure memory location.
  • integrity protecting comprises storing the calculated reference integrity protection value, e.g. a message authentication code value, in relation to the counter value to be protected, thereby making it available for subsequent audits of the counter value by the processing device.
  • the device calculates the integrity protection value of the counter value using the secret key stored in the device, and compares the result with the previously stored reference integrity protection value, e.g. reference MAC value.
  • the secret key need only be known to the digital processing device.
  • the secret key is a secret data item unique to the processing device, e.g. a secret data item known only to the processing device.
  • the generation and verification of the counter values by means of the corresponding integrity protection values is implemented by an integrity protection module, which integrity protection module is secured against modification, thereby increasing the security of the process.
  • the integrity protection module may for example be implemented by a protected hardware module and/or by trusted program code.
  • trusted program code is intended to include any integrity-protected program code, such as program code included in the firmware of the processing device, code that is cryptographically integrity checked prior to its execution, program code that is included in the boot ROM code of the processing device, or the like, e.g. based on a integrity protection value stored in a One-Time Programmable (OTP) memory.
  • OTP One-Time Programmable
  • the method further comprises
  • the processing device may receive the memory content via any suitable data interface, e.g. on a computer-readable medium such as a CD, a memory stick or other memory device, via a wired or wireless communications interface, or the like.
  • the verification of the authenticity may include any suitable technique known as such in the art, e.g. by means of a digital signature and/or certificate, by means of a message authentication code, and/or the like.
  • the version control may include any suitable version control mechanism known as such in the art, for example as used for software numbering of software modules in the IBM AIX Unix operating system and the numbering of the LINUX kernel, e.g. by comparing the version indicator with the current value of the version counter.
  • the updated memory content is accepted when the version indicator is larger or equal to the lowest authentic counter value of the version counter, i.e. the lowest counter value for which a valid integrity protection value is stored in the device.
  • the device When accepted, the device typically stores the updated memory content so as to replace the corresponding memory content.
  • the updating further comprises incrementing the version counter to a value corresponding to the version indicator of the received updated memory content as described herein.
  • the present invention relates to different aspects including the method described above and in the following, corresponding devices, and computer programs, each yielding one or more of the benefits and advantages described in connection with the above-mentioned method, and each having one or more embodiments corresponding to the embodiments described in connection with the above-mentioned method.
  • a data processing device configured to maintain a version counter indicative of a version of a memory content stored in said processing device is selectively operatable in one of a first and second mode, wherein access to operating the processing device in the first mode is limited to authorised users and controlled separately from access to the second mode.
  • the processing device is configured, when operated in the first mode, to perform the following steps:
  • processing device is intended to comprise any electronic device comprising processing means for data processing.
  • processing device is intended to comprise any electronic equipment, portable radio communications equipment, and other handheld or portable devices, and integrated circuits, chips or chipsets for use in such equipment.
  • portable radio communications equipment includes all equipment such as mobile terminals, e.g. mobile telephones, pagers, communicators, electronic organisers, smart phones, personal digital assistants (PDAs), handheld computers, or the like.
  • storage medium is intended to include any circuitry or device suitable for storing digital data items. Examples of such storage media include non-volatile memory, a read-only-memory (ROM), a random access memory (RAM), a flash memory, an Erasable Programmable Read-Only Memory (EPROM), or the like. In some embodiments, the storage medium is included in the processing device.
  • ROM read-only-memory
  • RAM random access memory
  • EPROM Erasable Programmable Read-Only Memory
  • a method of updating memory content stored in a processing device comprises:
  • processing means comprises any circuit and/or device suitably adapted to perform the above functions.
  • processing means comprises general- or special-purpose programmable microprocessors, Digital Signal Processors (DSP), Application Specific Integrated Circuits (ASIC), Programmable Logic Arrays (PLA), Field Programmable Gate Arrays (FPGA), special purpose electronic circuits, etc., or a combination thereof.
  • a computer program comprises program code means adapted to cause a data processing device to perform the steps of the method described above and in the following, when said computer program is run on the data processing device.
  • the program code means may be loaded in a memory, such as a RAM (Random Access Memory), from a storage medium or from another computer via a computer network.
  • a memory such as a RAM (Random Access Memory)
  • RAM Random Access Memory
  • the described features may be implemented by hardwired circuitry instead of software or in combination with software.
  • Fig. 1 shows a schematic block diagram of a device comprising one or more Application Specific Integrated Circuit (ASIC) as an example of a processing device, e.g. one or more ASICs for use in a mobile terminal or any other electronic equipment.
  • the ASIC device generally designated 100, comprises a central processing logic block 102, an interface block 186 for inputting/outputting data to from the ASIC device, and a data storage block 103 for storing data and/or program code.
  • the data storage block 103 is connected with the central processing logic block 102 via a system bus 105.
  • the data storage block 103 includes a program memory block 106 for storing program instructions, a data memory block 107 for accommodating registers, random access memory (RAM) and/or the like, and a re-writable non-volatile memory block 108, e.g. an electrically erasable programmable read only memory (EEPROM).
  • the program memory block may be implemented as read-only memory (ROM), and erasable programmable read only memory (EPROM), Flash memory, EEPROM or the like. It is understood, however, that the data storage block may include additional and/or alternative memory blocks or storage types.
  • the central processing logic block 102 comprises a microprocessor 188 or other logic circuitry-suitable for controlling the operation of a mobile terminal or other electronic equipment, e.g. by executing program code stored in the data storage block 103.
  • the central processing logic block 102 is configured to maintain a version counter value stored in a location 109 of the non-volatile memory block 108 for maintaining the version number of a program code stored in the data storage block 103.
  • the central processing logic block is configured to initiate integrity audits of the version counter value 109, e.g. at regular intervals, during the boot process, during installation/upgrade and/or before execution of the program code to which the version counter is associated, and/or the like.
  • the central processing logic block 102 is configured to initiate an incrementing of the stored version counter value 109 when a new version of the corresponding software is loaded into the data storage block 103.
  • the central processing block 102 comprises an integrity protection logic block 101 including logic circuitry configured to verify the integrity of the counter value 109 as described in greater detail below so as to protect the counter value from manipulation by an unauthorised user, e.g. modification, replacement by another value, in particular lower value, etc.
  • the non-volatile memory block 108 further comprises a storage location 110 for storing one or more integrity protection values for use by the verification process implemented by the integrity protection logic block 101.
  • the integrity protection values are generated by the integrity protection logic block 101 and used as reference integrity protection values by the integrity protection logic block 101 during verification of the counter value(s) stored at storage location 109.
  • the integrity protection logic block 101 is operatable in two modes, a first or so-called “prog mode", and a second or so-called “verify mode.”
  • the mode of operation is controlled by the central processing logic block 102 by means of a suitable control signal.
  • At least one initial reference protection value is generated by the integrity protection logic block 101 when operated in "prog mode.”
  • the generated integrity protection value is stored in storage location 110 as a reference value for later verification purposes.
  • the verification of the counter value(s) stored in location 109 is performed by the integrity protection logic block 101 when operated in the "verify mode.”
  • the integrity protection logic block 101 includes an access control block 111 configured to perform a separate authentication process when a user requests operation of the integrity protection logic block 101 in "prog mode".
  • the access control 111 may be performed by an access control block external to the integrity protection logic block 101. It is understood that operation of the processing device as such, e.g. in "verify mode,” may also be subject to a user authentication process, e.g. by means of an initial access control.
  • the access control 111 for operating the integrity protection logic block 101 in the "prog mode" may be performed in addition to the initial access control or alternative to the initial access control. In the first case, the user may be required to initially get authorised access to the device, e.g.
  • the device may for example be bootable in two alternative modes of operation, one including operating the device in "verify mode” and the other including operating the device in "prog. mode". Hence, depending on which mode the user wishes to operate the device in, the user performs a corresponding one of the access control processes.
  • the integrity protection logic block 101 is implemented as a protected hardware block, i.e. as a hardware block that is secured against unauthorised access.
  • the integrity protection logic block 101 is configured such that at least an initial integrity protection value only can be read out from the integrity protection logic block 101 when the ASIC is operated in "prog. mode", i.e. when the user who has booted the ASIC is authorised to operate the ASIC in the "prog mode.”
  • the verification of the user authorisation may be performed in any suitable manner, e.g. by requiring the user to enter an access code that is compared with a previously stored value, by requiring the user to enter a valid key card or other hardware security device, by performing an authentication mechanism based on a physical attribute of the user, such as a fingerprint, or any other suitable mechanism for establishing that the user is the one who has been authorised.
  • An example of a suitable method for providing proof of authorisation is the so-called Fiat-Shamir identification algorithm, e.g. as described in US 4,748,668 .
  • the access control for entering the "prog. mode" may be based on the same or a different authentication mechanism as the access control for operating the device in "verify mode". For example, access to both modes may be controlled by the same authentication mechanism based on an access code, but where different access codes are required for the two modes.
  • the hardware protection may be implemented by any suitable protection technique, for example the techniques used to protect the hardware in smart cards as described in Chapter 8.2 "Smart card Security” of “Smart Card Handbook”, by W Rakl, W Effing, 3rd ed., Wiley 2003 .
  • the counter value(s) 109 and the integrity protection value(s) 110 are stored external to the protected integrity protection logic block 101.
  • the counter value(s) 109 and the integrity protection value(s) 110 may be stored in unprotected non-volatile memory, in particular re-writable memory, e.g. the memory block 108 of the device of 100.
  • the ASIC device 100 is shown as a single block, it will be appreciated that the device 100 may be implemented as a plurality of different ASICs. For example, in order to reduce production costs, it may be desirable to implement the EEPROM and the microprocessor and integrity protection logic block on different ASICs. Hence, the terms ASIC and ASIC device are intended to include a single ASIC as well as a combination of separate ASICs.
  • Embodiments of the integrity protection logic block 101 will now be described in greater detail with reference to figs. 2 and 3 .
  • Fig. 2a shows a more detailed block diagram of an example of an integrity protection logic block.
  • the integrity protection logic block 201 comprises a MAC calculation block 212 configured to compute one or more cryptographic message authentication code (MAC) values for protecting respective counter values.
  • MAC cryptographic message authentication code
  • the secret k is accessible on the ASIC 100 but is not readable out of the ASIC 100.
  • An example of a suitable MAC function is the HMAC function as defined in the Network Working Group Request for Comments (RFC) 2104, "HMAC: Keyed-Hashing for Message Authentication", February 1997 .
  • the integrity protection logic block 201 receives the counter value 209 from the storage block 109 and feeds the counter value 209 into the MAC calculation block 212.
  • the MAC calculation block 212 further receives a secret key k, designated 216, stored securely against undesired read-out, e.g. in a secured memory, e.g. an internal ROM, of the ASIC 100 or the integrity protection block 201, i.e. such the integrity protection block 201 has read access to the secret key k.
  • the integrity protection block 201 can be operated in two modes, a "prog mode” and a “verify mode,” as controlled by a control input 215.
  • operation in "prog. mode” is subject to a corresponding access control implemented by access control 211.
  • access control block 211 receives the mode selection control signal 215. If the mode selection signal 215 corresponds to "prog. mode”, the access control block 211 verifies the authenticity of the user as to ensure that operation of the integrity protection block in "prog. mode” is limited to authorized users as described above. If the user is authorized, the access control block 211 forwards the mode selection signal 215 as a control signal to selector 218 so as to control the data flow of the calculated MAC value. If the mode selection signal 215 corresponds to "verify mode,” the access control block 211 forwards the selection signal to the selector 218. It is understood that, in some embodiments, the "verify mode” may also be subject to an access control.
  • the selector 218 When operated in “prog. mode,” the selector 218 forwards the calculated MAC value 287 via connection 220 to an output 214 from where the MAC value is stored as a reference MAC value in storage location 110.
  • the version count values are ordered in increasing orders, i.e. VersionCount 1 ⁇ VersionCount 2 ⁇ ... ⁇ VersionCount N . It is understood, however, that the counter values may be sequentially ordered according to any suitable ordering scheme.
  • the number N of pre-computed and stored MAC values may be selected as a trade-off between required storage space and the anticipated number of version updates that should be managed by the protected version counter.
  • the version MAC values 214 may be stored in relation to the respective version count values, e.g. in a tabular data structure as illustrated in fig. 2b .
  • the version MAC values may be stored independently of the version counter values. For example, in embodiments where the device includes logic for generating the sequence of counter values, e.g. by incrementing a counter, the counter values do not need to be explicitly stored.
  • the selector 218 feeds the calculated MAC-value to a verifier block 217, e.g. a comparator.
  • the verifier block 217 compares the calculated MAC value 287 with one or more of the reference MAC values 210 stored at storage location 110.
  • the verifier block may compare the calculated MAC value 287 with the reference value 210 stored in relation to the counter value from which the MAC value 287 was calculated.
  • the verifier block 217 may successively compare the calculated MAC value 287 with the stored reference values 210 until a match is found or until all reference values have been processed.
  • the verifier block 217 generates an output signal 219 indicative of whether a matching reference MAC 210 corresponding to the calculated MAC 287 was found, i.e. the output signal 219 indicates whether the counter value 209 is authentic and up-to-date.
  • the output signal 213 is output by the integrity protection block 201 at output node 213.
  • the integrity protection block is controlled to verify the current counter value stored in storage location 109 as described above. In some embodiments, the integrity of the version counter is verified each time a version control process accesses the version counter. If the calculated MAC value 287 corresponds to the reference MAC value 210 stored in the memory 110, the processing device continues to function normally; otherwise some or all of the functionality of the processing device are disabled and/or another appropriate action is taken.
  • the version counter described herein may be used for software version control in a number of different ways. In the following, two examples will be described where the current value of the version counter, i.e. the lowest counter value that has a valid integrity protection value associated with it, identifies the lowest allowed software version that is allowed to be executed on the processing device.
  • the version control is performed by the installed software itself.
  • the software is provided with a digital signature so as to ensure that the software has not been altered by an unauthorised user.
  • suitable methods for verifying the authenticity of the received/stored software include the methods described in US patent no. 6,026,293 , or in the specifications of the PC Client work group of the Trusted Computing Group (www.trustedcomputinggroup.org.) Alternatively or additionally, the authenticity of the software may be protected by another suitable mechanism.
  • the processing device verifies the digital signature of the software. If the digital signature is not verified successfully, the booting process and/or the execution of the software is aborted.
  • the software further includes a version indicator indicating the version number of the software.
  • the software compares its own version indicator with the current allowed version number(s) as indicated by the current counter value of the version counter maintained by the processing device as described herein. If the version indicator of the software is equal to or larger than the current counter value of the version counter, the software continues execution; otherwise execution is aborted. If the version indicator of the software is larger than the current counter value of the version counter, the processing device increments the version counter to an updated value equal to the version indicator of the installed software. As described herein, this incrementing includes removing the integrity protection value(s), e.g. MAC value(s), associated with all counter values smaller than the updated value.
  • the integrity protection value(s) e.g. MAC value(s
  • the version control described above is performed by a separate loader software or start-up software. Nevertheless, in this alternative embodiment, the digital signature or other integrity protection of the software to be executed still prevents unauthorised manipulation (e.g. altering of the version indicator) of the software to be executed.
  • the processing device 100 When the processing device 100 is controlled to update/increment/step-up the version counter from a current value to a subsequent value, the processing device 100 removes all reference MAC values associated with counter values smaller than said subsequent counter value from the memory 110.
  • the update of the counter value may be performed by a software update agent 141 executed on the microprocessor 188 of the central processing logic block 102.
  • the stepping up of the version counter is implemented in the secured part of the ASIC. Alternatively, the stepping up may be performed by trusted/verified software.
  • Fig. 2c illustrates the table of counter values and MAC values shown in fig. 2b , but after update of the counter value to VersionCount K , i.e. with the MAC values mac_VC 1_ re ,..., mac_VC k_1_ ref removed from memory.
  • the current counter value is the smallest counter value whose integrity is successfully verifiable, i.e. the smallest counter value for which a valid associated integrity protection value is stored in the device. Consequently, a subsequent attempt to verify the lower counter values by the integrity protection block would fail, as the corresponding reference MAC value is no longer present. Furthermore, a user who is not authorised to operate the ASIC in the "prog. mode" cannot re-compute MAC values corresponding to the previous (lower) counter values.
  • Fig. 3 shows a more detailed block diagram of another example of an integrity protection logic block 301.
  • the integrity protection logic block 301 is similar to the integrity protection block of fig. 2a and comprises a MAC calculation block 212 configured to compute one or more cryptographic message authentication code (MAC) values for protecting respective counter values, an access control block 211 controlling a selector 218, and a verifier block 217.
  • MAC cryptographic message authentication code
  • the MAC calculation block 212, the access control block 211, the selector 218, and the verifier block 217 have been described in connection with fig. 2a and will not be described again here.
  • the integrity protection block 301 differs from the integrity protection block 201 of fig. 2 in that the integrity protection block 301 comprises a further MAC calculation block 312.
  • the MAC calculation block 312 performs the same calculation as the MAC calculation block 212, and it receives the same secret key k. However, the MAC calculation block 312 receives an incremented counter value 333 instead of the counter value 209 fed into the MAC calculation block 212.
  • the integrity protection block 301 includes an incrementing block 332 that receives the counter value 209 and generates the incremented counter value 333, i.e. the next counter value in the sequence of counter values.
  • the MAC calculation blocks 212 and 312 may be combined in a single block, optionally together with the incrementing block 332.
  • the integrity protection block 301 includes only a single MAC calculation block which is controlled to generate the MAC values for the counter value 209 and the incremented counter value 333 sequentially.
  • the MAC value 331 of the incremented counter value 333 generated by the MAC calculation block 312 is fed to a switch 330.
  • the switch 330 is controlled by the output 219 of the verifier block 217 such that the switch 330 feeds the MAC value 331 to the output 213 if the verifier block 217 has successfully verified the MAC value of the current counter value 109 against the reference MAC value 110.
  • the MAC value 331 is not provided at output 213.
  • the integrity protection block 301 is configured so as to output the MAC value of VersionCount k+1 when the integrity protection block 301 is operated in "verify mode", and if the version counter value VersionCount k is verified successfully against its reference MAC.
  • the integrity protection block 301 is operated in "prog. mode” so as to generate and store one initial reference MAC for the first valid counter value only. Typically this is done during the production of the device, e.g. as part of a production step where the device is loaded with software by the manufacturer. In this case, the manufacturer is authorised to operate the device in "prog. mode.” Any key, password, or the like, required to activate the device in "prog. mode” may thus be kept secret by the manufacturer.
  • Fig. 4 shows a flow diagram of an embodiment of a counter mechanism.
  • the process receives the current counter cnt and the corresponding MAC reference value mac_cnt_ref.
  • the process compares the computed MAC value mac_cnt with the received reference MAC value mac_cnt_ref. If they are equal, the process proceeds at step S405; otherwise the process proceeds at step S404.
  • the process outputs an error condition "no" indicating that the verification of the current counter was not successful, and the process terminates.
  • the process may further output the incorrect reference value mac_cnt_ref which the process received.
  • this embodiment reduces the list of MAC reference values to be stored to the current and the subsequent reference value, thereby saving memory space in the device.
  • the processing device replaces the stored current reference value mac_cnt_ref with the subsequent reference value mac_(cnt+1)_ref calculated during a previous verification step.
  • the next reference MAC value mac_(cnt+2)_ref is thus generated during a subsequent verification step.
  • only the current reference value is saved.
  • a software update may involve a verification of the current counter, which in turn results in the subsequent reference value to be calculated and output as described above.
  • the current reference value may thus be replaced by the subsequent value in memory.
  • Fig. 5 shows an example of a data structure for maintaining version counter values and integrity protection values in connection with the embodiment described in connection with figs. 3 and 4.
  • Fig. 5a shows a tabular structure in which the current counter value - in this example VersionCount k - and the next higher counter value - in this example VersionCount k+1 - are stored in relation to their respective reference MAC values mac_VC k _ref and mac_VC k+1 _ref.
  • Fig. 5b shows the tabular structure after a version update to version VersionCount k+1 . Accordingly, in the tabular structure, the outdated counter value and reference MAC have been overwritten by the new current values VersionCount k+2 and mac_VC k+2_ ref, respectively.
  • the new subsequent values VersionCount k+2 and mac_VC k+2_ ref have been written into the data structure.
  • the current counter value is the smallest counter value whose integrity is successfully verifiable, i.e. the smallest counter value for which a valid associated integrity protection value is stored in the device.
  • a subsequent attempt to verify the lower counter values by the integrity protection block would fail, as the corresponding reference MAC value is no longer present.
  • a user who is not authorised to operate the ASIC in the "prog. mode” cannot re-compute MAC values corresponding to the previous (lower) counter values, since the ASIC, when operated in "verify mode” only outputs subsequent MAC values and not current or previous MAC values.
  • the embodiments have mainly been described in connection with a single software version counter. It is understood, however, that the method, device and product means described herein may also been applied to other types of version counters for counting other update events, states, etc. involving versions of memory content other than software versions. Examples of such memory contents include but are not limited to stored data, e.g. data stored in a database or the like. Similarly, a processing device may maintain more than one counter by means of the mechanisms described herein, e.g. different counters for different software entities or modules, data items, and/or the like.
  • the method, product means, and device described herein can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed microprocessor.
  • several of these means can be embodied by one and the same item of hardware, e.g. a suitably programmed microprocessor, one or more digital signal processor, or the like.
  • a suitably programmed microprocessor one or more digital signal processor, or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Claims (17)

  1. Verarbeitungsvorrichtung, die so konfiguriert ist, dass sie einen Versionszähler unterhält, der eine Version eines Speicherinhalts anzeigt, der in der Verarbeitungsvorrichtung gespeichert ist, wobei die Verarbeitungsvorrichtung einen Integritätsschutzblock (201) zum Authentisieren eines Zählerwerts umfasst, der Integritätsschutzblock einen ersten Nachrichtenauthentisierungscode-Berechnungsblock (212) umfasst, der so konfiguriert ist, dass er einen oder mehr Nachrichtenauthentisierungs-Codewerte zum Schützen jeweiliger Zählerwerte berechnet, und der Integritätsschutzblock ferner einen Moduswähler (218) zum Steuern von Datenfluss des einen oder der mehreren berechneten Nachrichtenauthentisierungs-Codewerte; einen Zugriffssteuerungsblock (211), der zum Steuern des Moduswählers konfiguriert ist; und einen Verifizierungsblock (217) umfasst;
    wobei der Integritätsschutzblock so ausgelegt ist, dass er einen Zählerwert (209) empfängt und den empfangenen Zählerwert dem ersten Nachrichtenauthentisierungscode-Berechnungsblock zuführt, wobei der erste Nachrichtenauthentisierungscode-Berechnungsblock so ausgelegt ist, dass er ferner einen Geheimschlüssel (216) empfängt, der gegen unerwünschtes Auslesen gesichert gespeichert ist, einen Nachrichtenauthentisierungs-Codewert (287) aus dem empfangenen Zählerwert und aus dem empfangenen Geheimschlüssel berechnet und den berechneten Nachrichtenauthentisierungs-Codewert an den Moduswähler weiterleitet;
    wobei der Integritätsschutzblock in einem ersten und einem zweiten Modus betrieben werden kann, wie durch eine Steuereingabe (215) in den Integritätsschutzblock gesteuert; wobei der Zugriffssteuerungsblock so ausgelegt ist, dass er das Moduswahlsteuersignal empfängt und, wenn das Moduswahlsignal den ersten Modus anzeigt, die Authentizität eines Benutzers verifiziert, der zum Betreiben des Integritätsschutzblocks im ersten Modus berechtigt ist, und den Moduswähler vorbehaltlich einer erfolgreichen Authentisierung des berechtigten Benutzers veranlasst, den berechneten Nachrichtenauthentisierungs-Codewert zur Speicherung des Nachrichtenauthentisierungs-Codewerts als einen Nachrichtenauthentisierungs-Referenzcodewert an einer Speicherstelle (110) weiterzuleiten;
    wobei der Zugriffsteuerungsblock ferner so ausgelegt ist, dass er, wenn das Moduswahlsignal den Betrieb im zweiten Modus anzeigt, den Moduswähler veranlasst, den berechneten Nachrichtenauthentisierungs-Codewert dem Verifizierungsblock zuzuführen; wobei der Verifizierungsblock so ausgelegt ist, dass er den berechneten Nachrichtenauthentisierungs-Codewert mit einem oder mehreren Nachrichtenauthentisierungs-Referenzcodewerten vergleicht, die an der Speicherstelle gespeichert sind, und ein Ausgangssignal (219) erzeugt, das anzeigt, ob ein übereinstimmender Nachrichtenauthentisierungs-Referenzcodewert gefunden wird, der dem berechneten Nachrichtenauthentisierungs-Codewert entspricht;
    wobei die Verarbeitungsvorrichtung so ausgelegt ist, dass sie nur dann mit dem normalen Betrieb fortfährt, wenn der berechnete Nachrichtenauthentisierungs-Codewert mit einem Nachrichtenauthentisierungs-Referenzcodewert übereinstimmt, der an der Speicherstelle gespeichert ist; und wobei die Verarbeitungsvorrichtung so ausgelegt ist, dass sie alle Nachrichtenauthentisierungs-Referenzcodewerte von annullierten Zählerwerten von der Speicherstelle entfernt.
  2. Verarbeitungsvorrichtung nach Anspruch 1, wobei der Integritätsschutzblock so ausgelegt ist, dass er, wenn im ersten Modus betrieben, eine Mehrzahl von Nachrichtenauthentisierungs-Referenzcodewerten für eine vorbestimmte Anzahl von der Reihe nach geordneten Zählerwerten berechnet und an der Speicherstelle speichert.
  3. Verarbeitungsvorrichtung nach Anspruch 2, wobei die Verarbeitungsvorrichtung so ausgelegt ist, dass die Verarbeitungsvorrichtung, wenn sie so gesteuert wird, dass sie einen Zähler von einem aktuellen Zählerwert auf einen nachfolgenden Zählerwert erhöht, alle Nachrichtenauthentisierungs-Referenzcodewerte, die mit Zählerwerten assoziiert sind, die kleiner als der nachfolgende Zählerwert sind, von der Speicherstelle entfernt.
  4. Verarbeitungsvorrichtung nach Anspruch 1, wobei der Integritätsschutzblock ferner einen zweiten Nachrichtenauthentisierungscode-Berechnungsblock (312) umfasst, der so ausgelegt ist, dass er den Geheimschlüssel empfängt, wobei die ersten und zweiten Nachrichtenauthentisierungscode-Berechnungsblöcke so ausgelegt sind, dass sie dieselbe Nachrichtenauthentisierungsfunktion ausführen und denselben Geheimschlüssel empfangen;
    wobei der Integritätsschutzblock einen Inkrementierungsblock (332) umfasst, der so ausgelegt ist, dass er den Zählerwert (209) empfängt, um einen inkrementierten Zählerwert (333) zu erzeugen, wobei der zweite Nachrichtenauthentisierungscode-Berechnungsblock so ausgelegt ist, dass er den inkrementierten Zählerwert (333) empfängt und einen Nachrichtenauthentisierungs-Codewert (331) des inkrementierten Zählerwerts berechnet; wobei der Integritätsschutzblock ferner einen Schalter (330) umfasst, der durch das Ausgangssignal des Verifizierungsblocks so gesteuert werden kann, dass er den Nachrichtenauthentisierungs-Codewert des inkrementierten Zählerwerts nur dann einem Ausgang des Integritätsschutzblocks zuführt, wenn der Verifizierungsblock den Nachrichtenauthentisierungs-Codewert des Zählerwerts (109) erfolgreich mit einem Nachrichtenauthentisierungs-Referenzcodewert, der an der Speicherstelle gespeichert ist, verglichen hat.
  5. Verarbeitungsvorrichtung nach Anspruch 4, wobei der Integritätsschutzblock, wenn im ersten Modus betrieben, so ausgelegt ist, dass er einen einzigen Nachrichtenauthentisierungs-Referenzcodewert für einen anfänglichen Zählerwert erzeugt und speichert.
  6. Verarbeitungsvorrichtung nach Anspruch 5, wobei die ersten und zweiten Nachrichtenauthentisierungscode-Berechnungsblöcke in einem einzigen Block kombiniert sind.
  7. Verarbeitungsvorrichtung nach einem der Ansprüche 1 bis 6, wobei der Geheimschlüssel gerätespezifisch ist.
  8. Verarbeitungsvorrichtung nach einem der Ansprüche 1 bis 7, wobei es sich bei dem Nachrichtenauthentisierungscode-Berechnungsblock um ein Hardwaremodul handelt.
  9. Verarbeitungsvorrichtung nach einem der Ansprüche 1 bis 8, wobei es sich bei der Verarbeitungsvorrichtung um einen programmierbaren Mikroprozessor handelt.
  10. Verarbeitungsvorrichtung nach einem der Ansprüche 1 bis 8, wobei es sich bei der Verarbeitungsvorrichtung um ein mobiles Endgerät handelt.
  11. Verarbeitungsvorrichtung nach einem der Ansprüche 1 bis 10, wobei die Verarbeitungsvorrichtung die Speicherstelle enthält.
  12. Verfahren zum Verifizieren der Authentizität eines Zählerwerts durch eine Verarbeitungsvorrichtung nach Anspruch 1, wobei das Verfahren umfasst:
    - Empfangen eines Zählerwerts (209) durch den Integritätsschutzblock von einem Speicherblock (109) und eines Geheimschlüssels (216), der gegen unerwünschtes Auslesen gesichert gespeichert ist;
    - Berechnen aus dem empfangenen Zählerwert und dem empfangenen Geheimschlüssel eines Nachrichtenauthentisierungs-Codewerts (287) zum Schützen des Zählerwerts;
    - Verifizieren, wenn das empfangene Moduswahlsignal (215) den ersten Modus anzeigt, der Authentizität eines Benutzers, der zum Betreiben der Integritätsschutzeinheit im ersten Modus berechtigt ist, und Weiterleiten, vorbehaltlich einer erfolgreichen Authentisierung des berechtigten Benutzers, des berechneten Nachrichtenauthentisierungs-Codewerts zur Speicherung des Nachrichtenauthentisierungs-Codewerts als einen Nachrichtenauthentisierungs-Referenzcodewert an einer Speicherstelle (110) ;
    - Vergleichen, wenn das empfangene Moduswahlsignal den Betrieb im zweiten Modus anzeigt, des berechneten Nachrichtenauthentisierungs-Codewerts mit einem oder mehreren Nachrichtenauthentisierungs-Referenzcodewerten, die an der Speicherstelle gespeichert sind;
    - derartiges Steuern der Verarbeitungsvorrichtung, dass sie nur dann mit dem normalen Betrieb fortfährt, wenn der berechnete Nachrichtenauthentisierungs-Codewert einem Nachrichtenauthentisierungs-Referenzcodewert entspricht, der an der Speicherstelle gespeichert ist; und
    - Entfernen aller Nachrichtenauthentisierungs-Referenzcodewerte von annullierten Zählerwerten von der Speicherstelle.
  13. Verfahren nach Anspruch 12, umfassend ein Berechnen und Speichern, wenn der Integritätsschutzblock im ersten Modus betrieben wird, einer Mehrzahl von Nachrichtenauthentisierungs-Referenzcodewerten für eine vorbestimmte Anzahl von der Reihe nach geordneten Zählerwerten.
  14. Verfahren nach Anspruch 13, umfassend ein Erhöhen eines Zählers von einem aktuellen Zählerwert auf einen nachfolgenden Zählerwert und Entfernen aller Nachrichtenauthentisierungs-Referenzcodewerte, die mit den Zählerwerten assoziiert sind, die kleiner als der nachfolgende Zählerwert sind, von der Speicherstelle.
  15. Verfahren nach Anspruch 12, umfassend:
    - Berechnen eines Nachrichtenauthentisierungs-Codewerts (331) eines inkrementierten Zählerwerts;
    - Ausgeben des Nachrichtenauthentisierungs-Codewerts des inkrementierten Zählerwerts nur dann, wenn der Verifizierungsblock den Nachrichtenauthentisierungs-Codewert des Zählerwerts erfolgreich mit einem Nachrichtenauthentisierungs-Referenzcodewert verglichen hat, der an der Speicherstelle gespeichert ist.
  16. Verfahren nach einem der Ansprüche 12 bis 15, ferner umfassend:
    - Empfangen einer aktualisierten Version des Speicherinhalts, wobei die aktualisierte Version einen Versionsindikator umfasst;
    - Verifizieren der Authentizität des empfangenen Speicherinhalts;
    - Durchführen einer Versionsprüfung des empfangenen aktualisierten Speicherinhalts basierend auf dem Versionsindikator und dem aktuellen Wert des Versionszählers;
    - Annehmen des empfangenen aktualisierten Speicherinhalts abhängig von einem Ergebnis der Versionsprüfung.
  17. Computerprogrammprodukt, umfassend Programmcodemittel, die so ausgelegt sind, dass sie das Verfahren nach einem der Ansprüche 12 bis 16 durchführen, wenn die Programmcodemittel auf einer Datenverarbeitungsvorrichtung ausgeführt werden.
EP06388031A 2006-04-24 2006-04-24 Prüfung der Berechtigung der Installation einer Softwareversion Not-in-force EP1850256B1 (de)

Priority Applications (10)

Application Number Priority Date Filing Date Title
EP06388031A EP1850256B1 (de) 2006-04-24 2006-04-24 Prüfung der Berechtigung der Installation einer Softwareversion
DE602006014801T DE602006014801D1 (de) 2006-04-24 2006-04-24 Prüfung der Berechtigung der Installation einer Softwareversion
AT06388031T ATE470909T1 (de) 2006-04-24 2006-04-24 Prüfung der berechtigung der installation einer softwareversion
CN200780014710.8A CN101427259B (zh) 2006-04-24 2007-04-18 维护版本计数器的方法和设备
PCT/EP2007/003389 WO2007121903A1 (en) 2006-04-24 2007-04-18 Authorisation of the installation of a software version
JP2009506952A JP5038397B2 (ja) 2006-04-24 2007-04-18 ソフトウェアバージョンのインストールの許可
US12/298,220 US8880898B2 (en) 2006-04-24 2007-04-18 Anti-roll-back mechanism for counter
KR1020087028597A KR20090005390A (ko) 2006-04-24 2007-04-18 소프트웨어 버전 설치의 권한
CA002646003A CA2646003A1 (en) 2006-04-24 2007-04-18 Authorisation of the installation of a software version
TW096114272A TW200817964A (en) 2006-04-24 2007-04-23 Anti-roll-back mechanism for counter

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP06388031A EP1850256B1 (de) 2006-04-24 2006-04-24 Prüfung der Berechtigung der Installation einer Softwareversion

Publications (2)

Publication Number Publication Date
EP1850256A1 EP1850256A1 (de) 2007-10-31
EP1850256B1 true EP1850256B1 (de) 2010-06-09

Family

ID=37398783

Family Applications (1)

Application Number Title Priority Date Filing Date
EP06388031A Not-in-force EP1850256B1 (de) 2006-04-24 2006-04-24 Prüfung der Berechtigung der Installation einer Softwareversion

Country Status (10)

Country Link
US (1) US8880898B2 (de)
EP (1) EP1850256B1 (de)
JP (1) JP5038397B2 (de)
KR (1) KR20090005390A (de)
CN (1) CN101427259B (de)
AT (1) ATE470909T1 (de)
CA (1) CA2646003A1 (de)
DE (1) DE602006014801D1 (de)
TW (1) TW200817964A (de)
WO (1) WO2007121903A1 (de)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109313427A (zh) * 2018-02-02 2019-02-05 深圳配天智能技术研究院有限公司 一种可编程逻辑芯片的保护电路及控制系统

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008018055A2 (en) * 2006-08-09 2008-02-14 Neocleus Ltd Extranet security
WO2008114257A2 (en) * 2007-03-21 2008-09-25 Neocleus Ltd. Protection against impersonation attacks
WO2008114256A2 (en) * 2007-03-22 2008-09-25 Neocleus Ltd. Trusted local single sign-on
US8474037B2 (en) 2008-01-07 2013-06-25 Intel Corporation Stateless attestation system
US20090307705A1 (en) * 2008-06-05 2009-12-10 Neocleus Israel Ltd Secure multi-purpose computing client
US8266684B2 (en) 2008-09-30 2012-09-11 General Instrument Corporation Tokenized resource access
US8364598B2 (en) * 2009-10-13 2013-01-29 Microsoft Corporation Use of software update policies
US8621337B1 (en) * 2010-09-30 2013-12-31 Juniper Networks, Inc. Detecting memory corruption
US20120204254A1 (en) * 2011-02-04 2012-08-09 Motorola Mobility, Inc. Method and apparatus for managing security state transitions
JP5759845B2 (ja) * 2011-09-21 2015-08-05 株式会社メガチップス 情報処理システム、情報処理装置、外部記憶媒体、プログラム、記憶媒体、及び、ファイル管理方法
GB2499985A (en) * 2012-02-29 2013-09-11 Nds Ltd Current state of OTP memory used with new received information to define new OTP state for computation of new digital signature in preventing playback attacks
US9910659B2 (en) * 2012-11-07 2018-03-06 Qualcomm Incorporated Methods for providing anti-rollback protection of a firmware version in a device which has no internal non-volatile memory
EP3910876A1 (de) 2013-03-15 2021-11-17 Assa Abloy Ab Verfahren, system und vorrichtung zur erzeugung, speicherung, verwendung und validierung von nfc-tags und daten
JP6393905B2 (ja) * 2013-12-12 2018-09-26 パナソニックＩｐマネジメント株式会社 モータ駆動装置
US9460312B2 (en) * 2014-03-11 2016-10-04 Qualcomm Incorporated Data integrity protection from rollback attacks for use with systems employing message authentication code tags
US9621549B2 (en) 2014-07-25 2017-04-11 Qualcomm Incorporated Integrated circuit for determining whether data stored in external nonvolative memory is valid
US9928385B2 (en) * 2014-08-29 2018-03-27 The Boeing Company Periodic memory refresh in a secure computing system
US9325506B2 (en) 2014-09-23 2016-04-26 Red Hat, Inc. Cryptographically enforcing strict separation of environments
WO2016071743A1 (en) * 2014-11-07 2016-05-12 Elliptic Technologies Inc. Integrity protection for data storage
US10042780B2 (en) * 2014-11-07 2018-08-07 Synopsys, Inc. Integrity protection for data storage
JP6595822B2 (ja) * 2015-07-07 2019-10-23 キヤノン株式会社 情報処理装置及びその制御方法
US10019309B2 (en) * 2015-12-28 2018-07-10 International Business Machines Corporation Analytics-based dynamic adaptation of client-server mobile applications
US10126960B2 (en) 2016-05-10 2018-11-13 Qualcomm Incorporated Fuse-based anti-replay mechanism
US10754988B2 (en) * 2016-08-30 2020-08-25 Winbond Electronics Corporation Anti-rollback version upgrade in secured memory chip
EP3614622A1 (de) * 2018-08-24 2020-02-26 Nagravision SA Senden und empfangen von nachrichten
CN113056740A (zh) 2018-11-30 2021-06-29 惠普发展公司，有限责任合伙企业 软件补丁差异设备
CN113168319A (zh) 2018-11-30 2021-07-23 惠普发展公司，有限责任合伙企业 轮询计算设备
US11128460B2 (en) * 2018-12-04 2021-09-21 EMC IP Holding Company LLC Client-side encryption supporting deduplication across single or multiple tenants in a storage system
WO2020118639A1 (zh) * 2018-12-13 2020-06-18 深圳市大疆软件科技有限公司 无人飞行器及其固件升级方法
US11288361B1 (en) * 2019-03-29 2022-03-29 NortonLifeLock Inc. Systems and methods for restoring applications
US10474809B1 (en) * 2019-07-12 2019-11-12 Capital One Services, Llc Computer-based systems and computing devices configured to utilize one or more authentication servers for securing device commands transmissions and methods of use thereof
JP7362583B2 (ja) 2020-09-23 2023-10-17 株式会社東芝 情報処理装置
KR20220093664A (ko) 2020-12-28 2022-07-05 삼성전자주식회사 크립토 장치, 그것을 갖는 집적 회로 및 컴퓨팅 장치, 및 그것의 쓰기 방법
US20220382868A1 (en) * 2021-06-01 2022-12-01 Mellanox Technologies Ltd. Unidirectional counter
CN113255263B (zh) * 2021-06-07 2021-10-01 上海国微思尔芯技术股份有限公司 颗粒带分割方法、装置、计算机设备和存储介质
CN113486399B (zh) * 2021-07-14 2023-03-24 上海瓶钵信息科技有限公司 基于risc-v架构的数据存储方法及系统
CN117668872A (zh) * 2023-12-04 2024-03-08 北京海泰方圆科技股份有限公司 一种数据保护方法及装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5643086A (en) * 1995-06-29 1997-07-01 Silicon Gaming, Inc. Electronic casino gaming apparatus with improved play capacity, authentication and security
GB2353120B (en) * 1996-06-28 2001-03-21 Intel Corp Method and apparatus for protecting flash memory
KR20010100011A (ko) * 1999-10-29 2001-11-09 요트.게.아. 롤페즈 보안 카운터를 경유하여 데이터 통합성을 보증하는 방법
JP4193321B2 (ja) * 2000-03-29 2008-12-10 オムロン株式会社 画像処理システム及びコンピュータ並びに画像処理装置及び処理方法
US9213836B2 (en) * 2000-05-28 2015-12-15 Barhon Mayer, Batya System and method for comprehensive general electric protection for computers against malicious programs that may steal information and/or cause damages
US20030037237A1 (en) * 2001-04-09 2003-02-20 Jean-Paul Abgrall Systems and methods for computer device authentication
US7159240B2 (en) * 2001-11-16 2007-01-02 Microsoft Corporation Operating system upgrades in a trusted operating system environment
JP2003202931A (ja) * 2002-01-09 2003-07-18 Toshiba Corp ソフトウェアダウンロードシステム、サーバ装置、端末装置、サーバ制御プログラム、端末制御プログラム、サーバ制御方法、端末制御方法
US7421579B2 (en) * 2002-06-28 2008-09-02 Microsoft Corporation Multiplexing a secure counter to implement second level secure counters
EP1429224A1 (de) * 2002-12-10 2004-06-16 Texas Instruments Incorporated Firmware Laufzeit Authentisierung
GB2411027B (en) * 2002-11-18 2006-03-15 Advanced Risc Mach Ltd Control of access to a memory by a device
US20050021968A1 (en) * 2003-06-25 2005-01-27 Zimmer Vincent J. Method for performing a trusted firmware/bios update
US7100205B2 (en) * 2003-10-22 2006-08-29 The United States Of America As Represented By The Secretary Of The Navy Secure attention instruction central processing unit and system architecture
US7940932B2 (en) * 2004-04-08 2011-05-10 Texas Instruments Incorporated Methods, apparatus, and systems for securing SIM (subscriber identity module) personalization and other data on a first processor and secure communication of the SIM data to a second processor
US7877313B2 (en) * 2004-04-16 2011-01-25 Sap Ag Method and system for a failure recovery framework for interfacing with network-based auctions

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109313427A (zh) * 2018-02-02 2019-02-05 深圳配天智能技术研究院有限公司 一种可编程逻辑芯片的保护电路及控制系统

Also Published As

Publication number Publication date
JP5038397B2 (ja) 2012-10-03
CN101427259A (zh) 2009-05-06
CN101427259B (zh) 2011-11-23
JP2009534765A (ja) 2009-09-24
US20090100272A1 (en) 2009-04-16
ATE470909T1 (de) 2010-06-15
US8880898B2 (en) 2014-11-04
WO2007121903A1 (en) 2007-11-01
DE602006014801D1 (de) 2010-07-22
EP1850256A1 (de) 2007-10-31
CA2646003A1 (en) 2007-11-01
TW200817964A (en) 2008-04-16
KR20090005390A (ko) 2009-01-13

Similar Documents

Publication Publication Date Title
EP1850256B1 (de) Prüfung der Berechtigung der Installation einer Softwareversion
EP1679573B1 (de) Aktualisierung von Speicherinhalt in einem Datenverarbeitungssystem
EP1560098B1 (de) Verfahren und System zur Gewährleistung der Installation oder Ausführung eines Software-Updates nur auf einem bestimmten Gerät oder einer Klasse von Geräten
EP0849657B1 (de) Verfahren und System zur sicheren Datenverarbeitung
EP2854066B1 (de) System und Verfahren zur Kontrolle der Integrität von Firmware mit Benutzung von mehreren Schlüsseln und OTP-Speicher
US8627086B2 (en) Secure loading and storing of data in a data processing device
JP4912879B2 (ja) プロセッサの保護された資源へのアクセスに対するセキュリティ保護方法
CN109937419B (zh) 安全功能强化的设备的初始化方法及设备的固件更新方法
TW201303636A (zh) 用於處理改變依照統一可延伸韌體介面計算裝置中之系統安全資料庫及韌體儲存區請求的系統及方法
JP2007293873A (ja) 電子装置の安全性を保証する方法、セキュリティシステム及び電子装置
WO2009080700A1 (en) Secure end-of-life handling of electronic devices
EP1645931A1 (de) Gesichertes Laden und Speichern von Daten in Datenverarbeitungsanlagen
CN103329095A (zh) 用编码的信息验证管理程序
US20100100966A1 (en) Method and system for blocking installation of some processes
JP7113115B2 (ja) シリコンデバイスファームウェア上のロールバック攻撃を防止するセキュリティシステム、および、方法
US11270003B2 (en) Semiconductor device including secure patchable ROM and patch method thereof
US8495389B2 (en) Locking changing hard disk content to a hardware token
EP1811460B1 (de) Sicherheitssoftwaresystem und -Verfahren für einen Drucker
WO2006039967A1 (en) Secure loading and storing of data in a data processing device
CN116089967B (zh) 数据防回滚方法和电子设备
US20240031143A1 (en) Apparatuses and methods for verification of updated data-set
JP2012039390A (ja) フレキシブル認証ルールの修正
KR20070017455A (ko) 프로세서 내에서의 보호된 리소스들로의 억세스에 대한안전한 보호 방법

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20070502

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK YU

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REF Corresponds to:

Ref document number: 602006014801

Country of ref document: DE

Date of ref document: 20100722

Kind code of ref document: P

REG Reference to a national code

Ref country code: NL

Ref legal event code: VDEP

Effective date: 20100609

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

LTIE Lt: invalidation of european patent or patent extension

Effective date: 20100609

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100910

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101009

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20101011

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

26N No opposition filed

Effective date: 20110310

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602006014801

Country of ref document: DE

Effective date: 20110309

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110430

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20111230

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110502

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110430

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110430

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100909

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100920

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20100609

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20200423

Year of fee payment: 15

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20220427

Year of fee payment: 17

Ref country code: DE

Payment date: 20220427

Year of fee payment: 17

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200424

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602006014801

Country of ref document: DE

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20230424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230424

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20231103